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Abstract — A secret key agreement setup between three users is 
considered in which each of the users 1 and 2 intends to share a 
secret key with user 3 and users 1 and 2 are eavesdroppers with 
respect to each other. The three users observe i.i.d. outputs of 
correlated sources and there is a generalized discrete memoryless 
multiple access channel (GDMMAC) from users 1 and 2 to user 3 
for communication between the users. The secret key agreement 
is established using the correlated sources and the GDMMAC. 
In this setup, inner and outer bounds of the secret key capacity 
region are investigated. Moreover, for a special case where the 
channel inputs and outputs and the sources form Markov chains 
in some order, the secret key capacity region is derived. Also a 
Gaussian case is considered in this setup. 

I. Introduction 

Secret key sharing between two legitimate users in the pres- 
ence of an eavesdropper was considered in [1| and [2] in the 
source and the channel model. In the source model, all the 
three users could observe i.i.d. outputs of correlated sources 
and there was a noiseless public channel with unlimited 
capacity for communication between the two legitimate users, 
through which all communications could be intercepted by the 
eavesdropper. In (TJ, secret key capacity is characterized in the 
source model when the noiseless public channel is one-way. In 
secret key sharing in a source model with public channel 
of limited capacity is investigated in which there is a helper 
with access to source observations correlated with the others 
observations. In [4|, the same problem of sharing a secret key 
is investigated in the source model where instead of the public 
channel, there is a noisy broadcast channel from the transmitter 
to the receiver and the eavesdropper. In [|5|, secret key sharing 
was considered in a framework where two users intended to 
share secret keys with a base station and the two users were 
eavesdroppers of each other's key. In [5], all the three users 
can observe i.i.d. outputs of correlated sources and there is a 
noiseless public channel with unlimited capacity from users 1 
and 2 to user 3. 

Motivated by the above works, we consider secret key 
sharing in a framework similar to |5| but in more conformity 
with real communication scenarios since the realization of 
public channel with unlimited capacity is not compatible with 
the noisy nature of wireless networks. Hence, instead of 
public channels with unlimited capacity, we consider noisy 
channels for communication between the users. Each of the 
users 1 and 2, as network users, intends to share a secret 
key with user 3, as a base station, and users 1 and 2 are the 



eavesdroppers with respect to each other. The three users have 
access to correlated sources and there is a generalized discrete 
memoryless multiple access channel (GDMMAC) to transmit 
the required information from users 1 and 2 to user 3. Users 

1 and 2 govern the channel inputs of the GDMMAC and each 
of the three users receives his corresponding output from the 
channel. Each of the users 1 and 2 generates a secret key from 
his observations and sends the required information via the 
GDMMAC to user 3. Users 1 and 2 use the channel outputs to 
eavesdrop each other's key. For this setup, we derive an inner 
bound of the secret key capacity region in which a combination 
of wiretap codebook and secret key generation codebook along 
with Wyner-Ziv codebook is used. Furthermore, an explicit 
outer bound of the secret key capacity region is given and for 
a special case, the secret key capacity region is derived. Also, 
the problem is discussed in a Gaussian case. 

The rest of the paper is organized as follows: in Section 
II, the proposed model is described. In Section III, our main 
results are given. A special case is investigated in Section 
IV. A Gaussian example is discussed in Section V. Conclu- 
sion and suggestions for future works are given in Section 
VI. Proofs of the theorems are presented in Appendices. 
Throughout the paper, a random variable is denoted with an 
upper case letter (e.g X) and its realization is denoted with 
the corresponding lower case letter (e.g., x). We use Xf 
to indicate vector -2Q,2 ; Xi^), and X^- to indicate 

vector (Xij,Xij + i, ...,Xi t k), where i denotes the index of 
the corresponding user. 

II. Preliminaries 

Users 1, 2 and 3 observe correlated discrete memoryless 
sources Si,S2 and S3, respectively, with joint distribution 
Ps!,S 2 ,S 3 m an i.i.d. manner. Furthermore, there is a GDM- 
MAC with probability distribution Py 1 ,Y2,y 3 \x 1 ,X2> indepen- 
dent of the sources, where users 1 and 2 govern the inputs Xi 
and X2, and then, outputs Yi, Y2 and Y3 are seen by users 1, 

2 and 3, respectively. Each of users 1 and 2 intends to share 
a secret keys with user 3 where user 1 is the eavesdropper of 
user 2's secret key and vice versa. 

For the secret key agreement, users 1 and 2 generate 
secret keys K\ and K2 as stochastic functions of the in- 
formation available at them, i.e., S^ 1 and S^, respectively. 
For i = 1,2,...,N, the i-th channel inputs Xxi and X2,i 
are determined as stochastic mappings Xi,i = fi,i(Si) and 



X 2 ,i=f 2 ,i(S 2 ) by users 1 and 2, respectively. These inputs are 
sent over the GDMMAC and then, channel outputs Y\ t i,Y 2t i 
and Y 3 j are observed by users 1, 2 and 3, respectively. User 
3 computes estimates of keys K\ and K 2 as: 

(K 1 ,K 2 )=g(Y 3 N ,S 3 Y ) (1) 
where g is a deterministic function. Users 1 and 2 use the 
channel outputs and Y 2 N to eavesdrop on each other's 
key, respectively. For simplicity, we assume that the number 
of source observations is the same as the channel uses. 
When these are not the same, the results can be deduced 
by considering a normalization coefficient. All the keys and 
random variables take values from some finite sets. Now, we 
state the conditions that should be met in the described secret 
key sharing framework as shown in Fig.l. 

Definition 1: In the secret key agreement strategy of the 
proposed model, the rate pair (J?i, i?2) is an achievable key 
rate pair if for every e > and sufficiently large N, we have: 

Pr{(ir 1 ,X 2 )^(i' l! X 2 )}< £ (2) 

i/(^ 1 ;5f,Xf,y 2 JV )<e (3) 

±I(K 2 ;S?,X 1 N ,Y 1 N )<s (4) 

±H(K 1 )> R 1 ~eand±H(K 2 )> R 2 -e (5) 
Equation |2]) means that user 3 correctly estimates the secret 
keys and equations Q and Q mean that users 1 and 2 
effectively have no information about each other's secret keys. 

Definition 2: The region containing all achievable secret 
key rate pairs (Ri,R 2 ) is the secret key capacity region. 

III. Main Results 

Now, we state the main result of the paper. 

Theorem 1: In the described model, all rate pairs in the 
closure of the convex hall of the set of all key rate pairs 
(Ri,R 2 ) that satisfy the following region are achievable: 

'Ri >0,R 2 >0 

Ri<[I([Ii;S 3 \U 2 )-I(Ui; S 2 \U 2 )]++[Ky i; Y 3 \ V 2 )-I(Vy, Y 2 \V 2 , X 2 )] + , 
< R2<[I{U 2 ; S 3 \U$-Ip 2 ; 5ij(/i)] + +[/(K 2 ; Y 3 \V^-I(y 2 ; 

fli+i? 2 <[/(T/i, U 2 ; S 3 )-Ip^S 2 \U 2 )-Ip 2 ; 5i|[/i)-/(T/i; U 2 )] + 

.+ [JfK , V 2 ; Fa)-/!^ ;Y 2 \V 2 , X 2 )-I(V 2 ; Yi \V U 
subject to the constraints: 

I(Uy, Si \U 2 , S3) < I(Vy, Y 3 1 V 2 ), I(U 2 ; S 2 1 U u S 3 ) < I(V 2 ; Y 3 \Vi), 

I(U 1 ,U2-,S 1 ,S 2 \S 3 ) < I(Vi,V 2 ;Y 3 ), 
for random variables taking values in sufficiently large finite 
sets according to the distributions: 

pi(«i, u 2 , Sl,S 2 , s 3 ) = p(m \si )p{u 2 \s 2 )p(s!,s 2 , s 3 ), 

pi(wi,w 2 ,x h x 2 ,y h y 2 ,y 3 )=p(ui)p(y 2 )p(a:i| Vi)p(i2| v 2 )p(y! ,y 2 ,y 3 | £i ,x 2 ) . 

The proof of Theorem 1 is given in Appendix I. Here, the 
sketch of the proof is given. To derive this inner bound, a 
part of the keys between the users is generated by using the 
source common randomness and the other part is generated by 
exploiting the channel common randomness. For this purpose, 
we impose the separation strategy as in |4| to the GDMMAC. 
At the first part of secret key sharing, users 1 and 2 generate 
secret keys using source observations. To share these keys 
with user 3, some information should be sent by users 1 and 




Fig. 1 : Secret key sharing using correlated sources over GDMMAC 

2 via the GDMMAC according to Wyner-Ziv codebook for 
multiple sources as in (7) and this information should satisfy 
the constraints of Theorem 1. The information sent by each 
user is independent of his secret key. On the other hand, 
the GDMMAC is noisy and not all of the information sent 
by user 1 can be decoded by user 2 and vice versa. Hence, 
part of the information sent via the GDMMAC can be itself 
used for secret key generation exploiting the channel common 
randomness. The latter rates are achievable if they belong to 
the secrecy rate region of the GDMMAC in j6). 

Proposition 1: The following region is an explicit outer 
bound of the secret key capacity region in the described setup: 
0<Ri<I(X V ,Y 3 \X 2 ,Y 2 ) + I(S i; S 3 \S 2 ) , 
0<R 2 <I(X 2 ;Y 3 \X 1 ,Y 1 ) +I(S 2 ;S 3 \S 1 ) , 
< Ri + R 2 < I(X U X 2 ;Y 3 ) + I(S U S 2 ; S 3 ). 

The proof of Proposition 1 is given in Appendix II. 

It should be noted that the separation strategy used in 
achievability may not be optimal in general and hence, we 
could not yet derive the secret key capacity region. In the next 
section, we investigate a special case where the rate region in 
Theorem 1 can achieve the capacity region. 

IV. Special Case 

In this section, we consider a special case of the general 
problem discussed in the previous sections. This special case 
arises when the channel inputs and outputs and the sources 
form Markov chains as: 

^C l ,X^-Y 1 -Y 3 , {X U X 2 )-Y 2 -Y 3 , Sx-S 3 -S 2 . 
Also, we constrain a special condition to the channel such that 
each of the channel inputs can be specified with access to the 
receiver's channel output and the other transmitter's input or 
in other words: 

h{Xi \x 2 , y 3 ) = 0, h{x 2 \Xi , y 3 ) = 0. 

In this case, the GDMMAC cannot itself provide secrecy; 
due to the Markov chains between the inputs and outputs, 
however, it can be used by users 1 and 2 to transmit the 
required information of the source common randomness. The 
secret key capacity region is given in the following theorem. 

Theorem 2: In the mentioned special case of the described 
setup, the secret key capacity region is the set of all rate pairs 
(Ri,R 2 ) that satisfy: 

Rx<I(Uv,S 3 \S 2 ) , R 2 <I{U 2 ;S 3 \S 1 ) , 
subject to the constraints: 

HU^S^Ss) < I(X i; Y 3 \X 2 ),I(U 2l S 2 \S 3 ) < IiX^YslX^, 
I{Ut; 5i|5 3 ) + I(U 2 ; S 2 \S 3 ) < I{X U X 2 - Y 3 ), 



for random variables taking values in sufficiently large finite 
sets according to the distributions: 

p(ui,u 2 , Si, s 2 , s 3 ) = p(ui|si)p(u 2 |s 2 )p(si, s 2 , s 3 ), 
Pi(xi,x 2 ,y 1 ,y 2 ,y 3 ) = p{xi)p(x 2 )p(yi,y 2 , y?,\xi,x 2 ). 

The achievability can be deduced from Theorem 1 by substi- 
tuting V\ = Xi,V 2 = X 2 and employing the Markov chains. 
The outer bound is proved in Appendix III. In this example, 
the GDMMAC is used just to transmit the required source 
common randomness information and hence, the problem can 
be treated as a pure source model with rate limited public 
channels. When the channel rates satisfy: 

H(Si\S 3 ) <I(X 1 ;Y 3 \X 2 ),H(S 2 \S 3 ) < I(X 2 ;Y 3 \Xi), 

H(S l ,S 2 \S 3 )<I(X 1 ,X 2 ;Y 3 ), 
the case is similar to the special case of the forward source 
model of [5 1 where the secret key capacity is the union of all 
rate pairs that satisfy: 

Ri <I(Si;S 3 \S 2 ) , R2<I(S 2 ;S 3 \Si). 

V. A Gaussian Example 

As a scalar Gaussian example, we consider the case where the 
source observations at the users are according to Markov chain 
Si — S 3 — S 2 . Then, without loss of generality, we can model 
them as 51 = 5*5 + E s> i, S 2 = S 3 + E s<2 where S 3 ,E s< i and 
E S}2 are independent zero mean Gaussian variables with 
variances P 3 ,N St i and N Si2 , respectively. The GDMMAC is 
described by: 

Y 3 = Xi + X 2 + E c , 3 , Y 2 =X 1 +X 2 + E c ,2, Yi =X X + X 2 + E c ,i, 

in which E c i ~ Af(0,N c i ) for i — 1,2,3 with the input 
power constraints Pi and P 2 at users 1 and 2, respectively. 
By the standard arguments as the discrete channel arguments, 
the results can be extended to Gaussian case. We consider: 

Vi = Xi,V 2 = X 2 ,S 1 =Ui + Di, S 2 = U 2 + D 2 

in Theorem 1 where U, ~A/"(0, Pry,), A ~Af(0, P 3 +N s<i -Pu t ) 

and Ui is independent of Di for i = 1, 2. 

By substituting the random variables as above in Theorem 

1, the following proposition for secret key rate region can 

be deduced for which the proof is relinquished due to space 

limitation. 

Proposition 2: (Ri, R 2 ) is an achievable key rate pair if is 
satisfies the equations at the top of the next page. 

For the values P 1 = P 2 = P 3 = 1, N 3> i = N s , 2 = iV c , 3 = 
0.5, the rate region is shown in Fig. 2 where N c i = N c2 
and they vary from 0.5 to 0.9. When N Ci i = N Ci2 = 0.5, no 
secret key can be generated through GDMMAC and the second 
terms of the secret key rates bound in Proposition 2 will be 
zero. In this case, the region is the secret key rate region of 
a pure source model with rate limited public channels. When 
these noises increase, the key rate region enlarges however 
the sum rate boundary remains fixed since the sum rate term 
related to channel common randomness is zero until these 
noises amount to about N c ,i = N c>2 = 0.75. At this point, 
the term related to the channel common randomness in the 
sum rate bound would be positive and hence, the sum rate 
bound increases. For iV c i = N c<2 = 0.8, the rate region is 
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Fig. 2: Secret key rate region for different values of N c i and N c2 

rectangular since each user's rate bound in proposition 2 will 
exceed the total sum rate bound. For N Ct i — N c _ 2 — 0.9, this 
region becomes pentagonal as the sum rate due to channel 
common randomness is increased such that the total sum rate 
bound dominates each user's rate bound. 

VI. Conclusion 

The problem of secret key sharing in a combined framework 
with both source and the channel common randomness was 
studied. For this problem, the inner bound and the explicit 
outer bound of the secret key capacity region were derived. 
The separation strategy used to achieve the inner bound was 
not optimal in general, however, for the especial case where 
the channel inputs and outputs and the sources form Markov 
chains in some order, the secret key capacity region was 
derived. It was shown that this case can be simulated as the 
source model of key agreement with public channels of limited 
capacity. As future work, the joint source channel coding can 
be investigated instead of the separation strategy. In addition, 
in a more practical scenario, some types of dependency 
between the source and the channel can be supposed. 

Appendix I 

Proof of Theorem 1 

We fix the distribution to be the same as in Theorem 1 . Users 1 
and 2 independently and randomly generate typical sequences 
and u 2 , respectively, each with probability: 

N N 

P( u l) = [[p( u l,i),p( u 2 ) = Y[p( u 2,i)- 
i=l i=l 
The number of the sequences and are 2 N ( I ( Ul ' Sl * >+£ >, 
and 2 JV ( / ( c/2;,S2 ) +e ), respectively, in which e'> can be chosen 
arbitrarily small. Using two-layered random binning, they are 
labeled as: 
Ui(kis,Ks>k" s ), 

k ls e {l,...,2 Nr ^},k' ls G {l,...,2 N ^s},k'l s G {l,...^'-"*} 

uZ(k2 S ,k' 2S ,k'j s ), 

k 2S € {l,...,2 Nr ^},k' 2S € {l,...,2 Nr '^},k'is G {l,...^^} 
where: 

r ls +r' 1 s = I(Ui;S 1 )~I(U 1 ;S 2 ) + 2e',r'{ s = I(U 1 ;S 2 )~E', (6) 
r 2 s+r' 2 s=I(U 2 ;S 2 )~I(U 2 ;S 1 ) + 2e',r'^ s = I(U 2 ;S 1 )-e', (7) 

It is obvious that rig+ri s +r'{ s = I(Ui \ Si)+e' and so, each 
sequence can be determined if the indices (kis, k' is , k" s ) 
are known. The same is true for u 2 . 



Rx >0,R 2 > 0, 

* * \ lo s(i + (PTO^gSfp^r ) + §P°s(i + - iog(i + 
^ < 5 Mi + (pto^Imw ) + + ifty) - Mi + 

D . p ^ 1, r/-, I ggijVVaj N/1 j Pu 2 PsN Sil 

«1 +«2 ^ 2 lOg^l + (( p 3+A r s il )3-P t/l P 3 )(F 3+ JV s .^A 1 + ((P 3 +JV s ,2) 2 -Pt7 2 P 3 )(P 3 +A r ,,i) ^ J 

+5[!og(l + ^) ~ Ml + 1&) - Ml + + 
due to the constraints: 

p < ^(Pa+jVe.i) 2 p <^ P2(P 3 +JV a , 2 ) 2 

^ - Af s ,i w c, 3 +Pi(P 3 + Af a ,i) ' 1/2 - A r s,2A r c, 3 +P2(P 3 +A r s,2) ' 

- PuJ(A 2 -P U2 )> MA 2 - (^^+Y nPM \ 
A = N Si1 N Si2 N Ci3 + P 3 iV Ci3 (iV S)1 + N s>2 ) + (Pi + P 2 )(P 3 + ^ Sl x)(P 3 + N St2 ), 

a _ (P 3 + N s , 1 ) 2 (N s , 2 N c . 3 + (P 1 +P 2 )(P 3 +N Si2 )) , _ (P 3 + W s ,2) 2 (Af s ,iA r c. 3 + (Pi+P2)(P 3 +jV s ,i)) 
Ai - ^ ,A 2 - ^ 



In addition to the secret key codebooks, the wiretap channel 
codebooks are generated. Users 1 and 2 generate independent 
sequences Vx and v 2 , respectively, each with probability: 

N N 

KO=npKi),KO=npKi) 

i=X i=X 

The number of sequences and v 2 is 2 Ar ^ ric ' +ri c) and 
2 N ( r 2c+r 2C ) > respectively, which are labeled as: 

< (toc.fcJcJ.fcic e {i,...,2^},fc' lc e {i,...,2^c} 
<(Aac7,*4c).*2c e {i,...,2^},fc 2C e {l,..,2^} 

where: 

ri c =I(Vi;X2,Y 2 \V 2 )-e",r' 2C ^ I(V 2 ; X 1 ,Y 1 \V 1 ) - e" (8) 

Two functions fx and / 2 are defined as: 

fx : Vx -> /C' 1S , / 2 : V 2 -> /C 25 , 

/C' 15 = {1,...,2^}, /C 2S = {1,...,2^-}, 

where Vx and V 2 are the set of 2 N ( ric+r ic) and 2 A '( r2C+r 2c) 
codewords v± and i^, respectively. Mapping f\ is a random 
partitioning of codewords into 2 JVri s equal-sized parts. 
Elements of part i are labeled as (Vx)i- Mapping f 2 is similarly 
defined. In the definition of fx, we assume that rxc+f'xc — r 'is 
and as we would see in the decoding step, this can be deduced 
from the constraint of Theorem 1. The same is true for f 2 . 

For encoding, when typical sequences and s 2 are 
observed at users 1 and 2, respectively, sequences and 
u 2 are chosen at the corresponding users such that (s^ ,u^) 
and (s^jU^) are e'— jointly typical. It can be seen that 
these sequences are unique with high probability for arbi- 
trarily small e'. For the sequences Ux (kxs,k' is ,k" s ) and 
11% (k 2 s, k' 2S , k 2S ), the indices kxs an d k 2 $ are chosen by 
users 1 and 2, respectively, to share with user 3 as the secret 
keys due to the source observations. For this purpose, the 
indices k' is and k' 2S are the required information to be sent 
by users 1 and 2 to user 3. User 1 encodes k' is in such a way 
that he returns randomly chosen from (Vx)fc' using the 
mapping fx. User 2 acts in a same way using mapping f 2 and 
returns v 2 . For the selected (kxc, k'xc) an d v 2 (k 2 c, h' 2 c)> 



user 1 and 2, respectively, consider kxc an d k 2 c to share 
with user 3 as the secret keys due to the channel common 
randomness. Then, the channel inputs and x 2 are sent 
over GDMMAC according to the distributions p{xx\vx) and 
p(x 2 \v 2 ). 

For decoding, user 3, first, chooses the sequences 
and v 2 which are £1— jointly typical with the received 
where e\ = |. User 3 decodes key pair (kxc>k 2 c) if 
(v N (kxc,k'x C ),v»(k 2C ,k 2C ),y?) e AW(P Vl , V2 ,y 3 ), when 
such (v^ (kxc, k' ic ), v 2 (k 2 c, k' 2C )) exists and is unique. Oth- 
erwise, it declares error. It can be shown that the decoding 
error probability of this step is bounded as: 

pW < El _|_ 2 N ( r iC+r' lc +r 2 c+r' 2C -(I(V 1 y 2 ;Y 3 )~4:S 1 )) + 
2N(ric+r' 1 c-( I (Vi;Y 3 \V 2 )-3£ 1 )) + 2N(r 2 c+r' 2C -(HV 2 ;Y 3 \V 1 )-36 1 ))_ 

If we set: 

no < J(Vi ;Y 3 \ V 2 ) - I(Vi ;X 2 ,Y 2 1 V 2 ) ,r 2C < KV2 ;Y 3 \ Vi) - I^Xx ,Yi I Vi) , 
nc+r 2C < /(Vi, V 2 ;Y 3 ) -I(Vi;X 2 ,Y 2 \V 2 ) - I(V 2 ; X u Y x \ VI), 

then by substituting r' ic and r' 2C from ((B), we have: 

pW < £l + 2 w (~ 2e "+ 4£l ) + 2 A '(- £ "+ 3£ i) + 2 Ar (~ e "+ 3£ i). 
By setting e" > 3ei = for example e" =4ei = |, we choose 
iV so large that 2 N ^' e "^ E ^ <ex , and then P e ( f } < 4e 1 = f. 
After correct decoding (kxc> k' ic ) and (k 2 c,k' 2C ), user 3 con- 
siders kxc an d fc 2 c to share with users 1 and 2, respectively, 
as the secret keys due to the channel common randomness. 
Then, using functions fx and f 2 , user 3 finds the mappings 
(Vx)i of the codeword and (V 2 )j of the codeword v 2 
and sets k' is = i, k' 2S = j. Now, user 3 decodes sequences 
u i (kxs, k[g, k'{ s ) and u 2 (k 2 s, k' 2S , k 2S ) such that: 

(wf (fclS, k' is = i, fc" s ), u 2 (k 2S , k' 2S =j, k 2S ), S3) ^Ai^(Pu 1 ,u 2 ,S^), 

when such (u^ (kis,k' is ,k'{ s ),u 2 (k 2 s,k' 2S ,k 2S )) exists and 
is unique. Otherwise, it declares error. For e 2 = f^, according 
to Wyner-Ziv problem for multiple sources in p |, the decoding 
error probability of this step is bounded as: 

pW < £ 2 + 2 N ^ i ^+ I( - U ^ U2 ' Sl ' S2 ^- ( - r '^+ r 2s)) 

_^2 N ( 7£ 2+ I (Ui;S 1 \U 2 ,S 3 ) -r' is ) + 2N{7£2+I(U 2 ;S 2 \U u S 3 )-r 2S ) ^ 



If we set: 

ns < I(Ui;S 3 \Ua) - I{Ur,S 2 \U 2 ), 
r 2S <I{U 2 ;S 3 \U 1 )-I(U 2 ;S 1 \U 1 ), 

ns+r 2S <I{U 1 ,U 2 ;S 3 )~I(U 1 ;S 2 \ U 2 )-I{U 2 ;Si j Ui) -I{Ui; U 2 ) , 
then by substituting r' is and r' 2S from (|6]l and d7J, we have: 

< e 2 + 2 N< - li£2 ~ i£ " > + 2 N( - j£2 ^ 2e "> + 2 A, ( 7e2 ~ 2£ ') 



AN) 



By setting e' > ^e 2 , for example e' — Ae 2 = |, we choose N 
so large that 2 w ( 14e2 - 4e ') < e 2 , and then P e ( f } < 4e 2 = |. 
After this step of decoding, user 3 considers k\s and k 2 s to 
share with users 1 and 2, respectively, as the secret keys due 
to the source observations. 

By the above arguments, the total decoding error probability 

< e. 



is bounded as P e (A ° < P e ( f ) 



(AO 



For correct decoding in the first step, according to P el 
equation, it is necessary that: 

ric+r[ c < I(V i; Y 3 \V 2 ) ,r 2C +r' 2C < I(V 2 ;Y 3 \V X ) 
rw+r' lc + r 2C +r' 2C < I(V U V 2 ; Y 3 ) 

and hence, considering the rate constraints in Theorem 1, the 
functions /i and f 2 can be defined. 

Now, we should check the security conditions of definition 
1 and show that the indices (kis, k\c) can be shared as secret 
keys between user 1 and user 3 and (k 2 s, k 2 c) can be shared 
as secret keys between user 2 and user 3. We give the proof 
of |3]l and by symmetry, Q can be deduced. We have: 



I{K 1S ,K 1C ;SZ,X»,Y 2 N ) 



I(K 18 ',S?,X?,Y 2 



N 



K 1C ) + I(K 1C ;SZ,X»,Y 2 



Now, we analyze each term separately. We consider e 3 = e 4 = 
£5 = Eq = §. Some Markov chains useful in the security 
analysis are given in continue. These Markov chains arise from 
the coding scheme. 

p?,Ui) - (K' 1S ,K! 2S ) ~ <y"y 2 N ) - ,X?) - (Y 1 N ,Y 2 N ,Y 3 N ) (9) 
U? - Sf - S? ~ Ui 1 (10) 
V? - Vf - K' 2S - U 2 N ~ S? (11) 

For term A, we have: 

I(K 1S ; S? , X? ,Y 2 N \K 1C )<I(K 1S ; S? , X? , Y 2 N , K 1C ) 

< I{K 1S ;S? ,X? ,Y 2 N ,K 1C ,K' 1S ,K' 2S ) 
^I{K 1S -S^K' 1S ,K! 2S ) 

^I(K 1S ;S^,K' 1S ) = H(K 1S )-H(K 1S \S?,K' 1S ) 

= H(K 1S ) - H(K 1S ,U? \S?,K' 1S ) +H(U 1 N \S?, K' 1S , K IS ) 

< H(K 1S ) - H(K 1S , U^S?, K[ s ) + Ne 3 

< H(K 1S ) - H{U? |Sf , K[ s ) + Ne 3 



< H{Kis) - H(Uf, K' 1S \S?) + H(K' 1S \S$ 



■Ne 3 



H(Uf \S?) + H{K[ S \S?) + Ne 3 



H(K 1S 

< H{Kxs) - H{U? |Sf ) + H(K' rs ) + Ne 3 

= N(I(Ui;Si) - I{Ur,S 2 ) + 2e') - H(U? \S?) + Ne 3 

< N(I(Uv, Si)-I(Uv, S 2 )+2e')-NH{U 1 \S 2 ) + Ne 4 + Ne 3 

< Ne 3 + 2Ne' + Ne 4 = N%. 



In above equations, (a) and (b) follow from Markov chains 
(|9]l and ( ffOj i, respectively, (c) can be deduced from the same 
approach as lemma 2 in [6] to show 11(17^ , M[, M x ) < 
Ns 3 . (d) follows from the fact that k' is is one of the indices 
of u N . To prove (e), the same approach as lemma 3 in [6] is 
exploited to show ATP^Sy < I(U^\S^) + Ne 4 . 

For term B, we have: 
I(K 1C ; S?,X?, Yf) < I(K 1C ; S?,X», Y 2 N , V 2 N ) 



H(K 1C ) - H{Kxc \S? t X? t Y 2 N , V 2 N ] 



= H(K lc )-H(K lc ,V 1 N \Si 
H(V L N \Kic i S?,Xi' 1 Y a rr ,V 2 N ) 



+ 



H(K 1C , Vf \S?,X?, Y 2 N , V 2 N ) + Ne 5 



H{Vx N 



S?,X 2 N ,Y 2 N ,V 2 N ) + Ne 5 



H(V 1 N \X? y Y 2 N ,V 2 N ) + Ne 5 
- NH(Vi \X 2 , Y 2 , V 2 ) + Ne 5 + Ne 6 

I{Vi;X 2 ,Y 2 \V 2 )) - NH(Vi\X 2 ,Y 2 ,V 2 )+ 



(a) 

< H{K 1C ) 

= H(K 1C ) 

(d) 

< H(K 1C ) 

< N(I(Vi;Y 3 \V 2 ) 
Ne 5 + Ne 6 

= -NH(Vi \Y 3 , V 2 ) + Ne 5 + Ne 5 

< Nes + Ne G = JVf 

In the above equations, (a) can be deduced from the same 
approach as lemma 2 in [6] to show H (Vf\K lc X 2 ,Y 2 N , V 2 N ) < 
Afe 5 . (b) follows from the fact that k\c is one of the indices 
of Vi .(c) can be followed from Markov chain (|TTJ. The 
same approach as lemma 3 in [6] can be exploited to show 
NH(V!\X 2 ,Y 2 ,V 2 ) < H(y 1 N \Xi i ,Y 2 N ,V 2 N )+Ne 6 . (e) is a direct 
consequence of reliable decoding at user 3. 
Hence, the security condition ^ is satisfied as: 

,3e 



• ° 2 ! ^2 



Y 2 N ) < N (- + -)=Ne. 



To show that the total rate of user l's key is sum of ri$ 
and ric, we should prove the independency of the keys of the 
two steps. When analyzing term A of the security condition, 
we show that I(K 1S ; ,X? , Y 2 N ,K 1C ) < and hence 
I(Kis;Kic) <Ne, and this completes the proof of theorem 1. 

Appendix II 

Proof of the explicit outer bound in Lemma 1 

First, users 1 and 2 generate secret keys K\ and K 2 , re- 
spectively, as stochastic functions K\ = fi(S^) and K 2 = 
hiS^). Then, they determine the channel inputs as stochastic 
functions Xf = / 3 (5f) and X? = / 4 (S' 2 V ) and send 
them via The GDMMAC. Consequently, Yf,Y 2 N and Y 3 N 
are received by user 1, user 2 and user 3, respectively. User 
3 should be able to reconstruct the secret keys and according 
to Fano's inequality for an arbitrary small e > 0: 

H(K U K 2 \Y 3 N ,S») < ATt^M+^logl/CtH^I-l)) 4 Ne 1: 

where e\ — > if e — > 0. Also, the following security conditions 
should be satisfied as: 

I{KvSZ,X?, Y 2 N ) < Ne, I(K 2 ; SF,X», Y») < Ne. 



Now, we show that for the secret keys satisfying the reliability 
and security conditions described above, we can deduce the 
explicit outer bound of Lemma 1 . We prove the outer bound 
on i?i (symmetry can be used for R 2 ). 

Ri = jfH(Ki) < ±H{K, \S?,X?,Yf) +e 

(t>) 

< iJJ(K, \S?,X?,Yf) - \S?,Yf) + £l +£ 

< ; S?, Yf | S?,X?, Yf) +e 1+ e 

< X?; S?, Y 3 N \S?,X?, Y 2 N ) +e 1+ e 
= j ! HS?,X?;S?\S?,X?,Yf) + 

±I(S? , X? ; Yf\S?, S?, X?, Yf) + ei + e 
= ^(HiSi 1 \S?,X?,Yf) -HiS? \S?,X?;S?,X?,Yf)) 
+j f IiS?,X?; Yf \S?, S?, X?, Yf) + £l + e 

< ±(H(S? \S?) - H(S? \S?,X?,S?,X?,Yf)) 
+ ±I(SF,XF; Yf | S? , S?, X?, Yf) + £1 + e 

( => ±{H(S? \S?) - H{S? \S?, S?) ) 

+ j f I(S?,X?; Yf | S? ,S?,X?,Yf)+ei+e 

< ; S? \S?) ) + j,iHiYf \X? , Yf) 
-HiYf \S?, X? , S?, S?, X?, Yf) )+e 1+ e 
( => ±I(S?;SF\S?) + UH{Y 3 N \X?,Y 2 N )- 

HiYf\X?,X?,Yf)) + ei+e 
= S? \S?) + ±I{XF; Yf \X?, Yf) + ei + e 

<I(Si;S 3 \S2) +IiX 1 ;Y 3 \X 2 ,Y 2 ) + ei + £ 

where (a) results from the security condition, (b) from Fano's 
inequality, (c) from the fact that given (Si, S 2 ), S3 is indepen- 
dent of (Xi , X 2 , Yf) and (d) from the fact that given (X 1 , X 2 ), 
Y3 is independent of (Si, S 2 , S3). 

The sum rate upper bound can be deduced from Fano's 
equality. 

Appendix III 
Proof of the converse in Theorem 2 

To derive the outer bound in Theorem 2, for an arbitrary small 
e > 0, we use Fano's inequality and security conditions as: 

H(K u K 2 \Yf, S?) < iV(^M + e( i og \ Kl \\K: 2 \ - 1)) A Nei, 

I(K i; S?,X? ,Yf) < Ne, IiK 2 ;S?,X?,Yf) < Ne, 

where £1 — > if s — > 0. We prove the outer bound of R\. The 
outer bound of R 2 can be deduced by symmetry. 

Ri = j^HiK,) < ±HiK, \S?,X?,Yf) + e 

<±HiKi\S?,X?,Yf)+e 

< ifffft \S?,X?,Yf) - jfH[Ki \S?,Yf) + e 1+ e 

< jjHiKi\ S?, X? , Yf) — ±HiK 1 \S?,X?,S?,Yf)+e 1 +e 
®±H(K4&, X?,X?,Yf)- ±HiKi\S?,X?,X?,S?,Y?)+ei+e 

< ±H{Ki \S?,X?) - ±H[Ki \S?,X?,S?) +ei +e 

= ±IiKi;S?\S?,X?)+ei+e<±IiKi,X?;S?\S?)+ei+e 
= ^Eti^i^M^+i^) +e 1+ e 
= j/ Eili I[K\,X? ;S 3 ,i \S? i+1 ,S 2A ) + ei + e 
=Ji'l2iLi\H(S3,i\S3,i+h S 2 f — HiS 3 ,i\S^ ti+1 , SI,!, Ki, Xi)]+ei+e 



< jr EjIi[-ff(53,^ 2 , i )- J ff(S 3 , i |S 3 Ar i+1 ,S|, 1 ,^7 1 1 ,X 1 ,X 1 Ar )]+ ei + e 

= 1 [^(^3,^2,4-^3,^3^+!, S 2iV S[-\ K h Xf)]+£ 1+ £ 

= ji Eti HUi,i; S 3li \S 24 ) + £l +e^ IiU UQ ;S 3 , Q \S 2 , Q ) + e' 

where (a) results from the security condition, (b) from the 
Markov chain (X h X 2 ) —Y 2 — Y 3 , (c) from Fano's inequality, 
(d) from the fact that #(Xi|X 2 ,y 3 ) = 0, (e) from the fact that 
given [X h X 2 ), Y s is independent of iSi,S 2 ,Ss),(f) from the fact 
that given S^ i+1 ,(K h X\) is independent of S 2i+1 which is 
the direct consequence of the Markov chain Si — S 3 — S 2 , (g) 
from the Markov chain S^-iSf^^S^i^ff^^fySf^ 
which arises because [Ki,Xf) is a function of Sf, (h) from 
the definition of the random variable Uij as: 

= {S3,i+iiSl7i>Ki,Xi) 

and (i) from the definition of the random variable Q which 
is uniformly distributed on {1,2, ...,N} and setting s'=ei+ 
e. With the same approaches as above, we have R 2 < 
I(U2,q;S 3 ,<$Si,q) + e' where U 2 ,i is defined as U 2 s = 
(Sf] 1 ,S 2i+1 ,K 2 ,X 2 ). It can be seen that the defined random 
variables satisfy the distribution of theorem 2. 

To prove the rate constraints of Theorem 2, we have: 

iV/(X i; Y 3 \X 2 ) > /(Xf; Yf \Xf) > I(Sf; Yf \Xf) 

> IiS?; Yf \X?) + HiKi \S?, Yf ,X?) - Nei 

> IiS?; Y?\X?)+HiK 1 \S?, Yf X?)-HiK 1 \S?, Yf X?)-N £l 
= IiS?; Yf, K\ \X?) - IiS?; K, \Yf,X?) - N £l 

> IiS?; Yf, K! \X?) - IiS?; Yf, Ki \X?) - Ne 1 

( =' IiS? ; Yf, K U X? \X?) - IiS?; Yf, K^X? \X?) - N £l 
( =' IiS?; K U X? \X?) - IiS?; K U X? \X?) - Nei 
^HiK!,X? \S?) - IiK!,X? \S?) - Nei 
= IiS? ; K h X?) -IiS?;Ki,X?)-Nei 

= IiK h X?; S?\S?)-Nei=j:? =1 Wi, X?;Si,iS?, Sff- N £l 

= Eti I(K!,X?; S hi \S&, Si;?) - Nei 

= £ili[tfOSi,i|S3,0 - HiSi^^Si;? ,Ki,X?)] - Nei 

= Eti I(Ki,X?, S? ti+U Sf?; Si,i \S 3 ,i) - Nei 

= I(Ui,q;Si,q\S 3 ,q) - Nei. 

In the above equations, (a) results from Fano's inequality, 
(b) from the fact that HiX 1 \X 2 ,Y z ) = 0, (c) from the fact that 
given iXi,X 2 ), Y3 is independent of [Si, S 2 ,Sf and (d) from 
the Markov chain (S? ,K U X?)-S? ~iS? ,K 2 ,X?). 

With the same approaches, we have NIiX 2 ;Y 3 \Xi) > 
I(U 2 , Q ;S 2iQ \S 3 , Q )-Nei. 

For the sum rate constraint, we have: 

Eili u 2 x, Si,i, s 2i i\s 3i i) 

EN j I is vN ciN cfi—1 jy \rN ni—1 rjJV . q q \q \ 
i=1 -l(J^l,^l ) * 5 3,i+l)'-'l,l i fl 2,A 2 !"->3,l i &2,i+l> &2,i\03,i) 

=Eti[ H ( s ^ s 2,i\s 3 ,i)- 

il(,Ol,i,02,i|Ai,Ai ,K 2 ,X 2 ,b 2t i+l,& 3 )\ 

= 52?=il H (S^ S 2 ,iS 3ti ) - HiS hi \Ki,X?, Slf,S?)- 

HiS 2 ,i\K 2 , X? , S? i+ i, S?)] 
= HiS?, S?\S?) - HiS?\Ki,X?, S?) - HiS?\K 2 , X? , S?) 

< HiS?,S?\S?)-HiS?\Ki,X?,X?,Yf,S?)- 
HiS?\K 2 ,X?,X?,Yf,S?) 



= H(S? ,S?\S?) - H(S?\K 1 ,Xi',Y 3 N ,Si r )~ 

H(S?\K 2 ,X?,Y 3 N ,S?) 
® H{S?,S? \S?) - H(S? \K U Y 3 N , S?) - H(S? \K 2 , Y 3 n ,S?) 
<I(S^,S^;K 1 ,K 2 ,Y 3 N \Si') 

= H(K U K 2 ,Y 3 N \Sf) - H(K U K 2 , Y 3 N \SF , S? , S?) 

(b) 

< H(Y 3 N \S?) - H(Y 3 N \S?,Sf, S?) + N £l 

< H(Yf) - H(Y 3 N \XF,X?, Sf, Sf , S?) + N £l 

= H(Yf) - H(Y 3 N \XF,X?) + N £l = I{XF,X?; Y 3 N ) + N £l 
<NI(X U X 2 ;Y 3 ) + Nei 

In the above equations, (a) results from the Markov chain 
{S^K^X?)- Sf- {S?,K 2 ,X?) and (b) from Fano's 
inequality. 
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